What the real exam feels like

The Associate Cloud Engineer exam is not a deep architecture exam, but it absolutely punishes vague knowledge. It sits in that annoying middle ground where Google expects you to know what service to choose, the exact operational step to take, and sometimes the CLI command family that fits. When I took it, the questions were mostly multiple choice and multiple select, and the pacing mattered because many prompts were short but scenario-heavy. You usually have enough time to finish, but only if you don’t burn minutes trying to remember whether a task belongs in IAM, Resource Manager, VPC, or the specific product’s own settings.

The exam blueprint is broad, but in practice the bulk of the difficulty clusters around these patterns:

Deploying and managing workloads: Compute Engine, GKE, Cloud Run, App Engine.
Storage and databases: Cloud Storage classes and lifecycle behavior, Cloud SQL basics, sometimes Spanner/Bigtable positioning.
Networking: VPCs, subnets, firewall rules, routes, load balancers, Cloud VPN, VPC peering.
Identity and permissions: IAM roles, service accounts, least privilege, project/folder/org policies.
Operations: logging, monitoring, startup scripts, instance templates, managed instance groups, backups, snapshots.

The exam does not usually ask for obscure internals. It asks for the Google-preferred operational answer. That means if a question says “quickly deploy,” “minimize admin overhead,” “serverless,” “global,” “private communication,” or “least privilege,” those words are not filler. They are often the entire key to the answer.

A very practical pacing rule: if a question turns into a memory contest over a product detail you only half remember, mark it and move on. The exam has enough direct, high-yield questions that you don’t want to lose time on one weird edge case about a storage class transition or a load balancer type.

Where the points really come from

If you have limited time, do not spread your study evenly across all GCP services. The exam is called Associate Cloud Engineer for a reason: day-1 and day-2 operations matter more than fancy design. The highest-return study areas are the ones where Google can ask the same concept from five different angles.

Start with Compute Engine. This is one of the most tested areas, and Google loves operational wording here:

creating VMs with the right machine type
resizing persistent disks
using snapshots vs images
managed instance groups vs individual VMs
instance templates and autoscaling
startup scripts and metadata
preemptible/Spot behavior
sole-tenant or shielded VM references when security/compliance is mentioned

Then hit IAM and service accounts hard. Many candidates know what IAM is but miss the implementation detail. Common exam traps:

confusing a user role assignment with a service account attached to a resource
granting broad project roles when the task only needs a product-specific role
forgetting that applications on GCE often authenticate through the attached service account rather than stored keys
choosing service account keys when Workload Identity, attached service accounts, or built-in identity is the safer answer

Next priority is networking. Google asks networking in a very ACE-style way: not advanced theory, but practical setup and troubleshooting. You need to know:

default vs custom mode VPCs
regional nature of subnets
firewall rules are stateful
routes are destination-based
private Google access and Cloud NAT scenarios
internal vs external load balancing
what VPC peering can and cannot do
Shared VPC basics

After that, focus on Cloud Storage, GKE basics, Cloud Run, and App Engine. You do not need to be a Kubernetes expert, but you do need to know when GKE is overkill versus when Cloud Run is the obvious low-ops answer.

If I had to rank the highest-yield review order for the last stretch, it would be:

Compute Engine operations
IAM, service accounts, and org/project structure
VPC, firewall, load balancing, Cloud NAT/VPN/peering
Cloud Storage and lifecycle/versioning/access patterns
GKE basics, Cloud Run, App Engine
Logging/Monitoring and deployment tooling
Database product positioning

Service selection traps Google uses again and again

A huge chunk of this exam is really a service-selection exam dressed up as operations. The tricky part is that the wrong answers are usually plausible. The way to beat these questions is to memorize the default Google answer for a given constraint.

Here are the patterns that came up repeatedly in my prep and matched the real exam style:

Stateless containerized web app, minimal ops, scale to zero → Cloud Run.
Containerized app with Kubernetes requirements, custom orchestration, more control → GKE.
Simple web app with standard runtime, PaaS feel → App Engine.
Lift-and-shift VM workload or OS-level control needed → Compute Engine.
Shared file/object storage, static assets, backups → Cloud Storage.
Managed relational database → Cloud SQL.
Massive horizontal NoSQL analytics-ish pattern → Bigtable.
Global strongly consistent relational scale → Spanner.

Google also likes to add one extra sentence that changes the answer. Example: a question may sound like Cloud Run until it mentions daemonsets, node pools, or Kubernetes-native deployment controls. Then it’s GKE. Another may sound like Compute Engine until it says HTTP service with unpredictable traffic and no server management requirement. Then Cloud Run or App Engine becomes the better fit.

Pay attention to words like these because they usually map directly to a product choice:

"least administrative overhead" → usually managed/serverless service
"migrate existing VM-based app" → often Compute Engine first, not a full refactor
"private communication between VPCs" → VPC peering or Shared VPC depending on org model
"grant temporary access to objects" → signed URLs, not changing bucket IAM for everyone
"restrict access at organization level" → org policy/folder/project hierarchy, not just project IAM

One specific trap: candidates often over-pick GKE because it feels more "cloud engineer." Google often prefers the simpler managed answer. If the app is just an HTTP container and nothing in the prompt truly requires Kubernetes, Cloud Run is frequently the intended choice.

Compute Engine questions: the places people slip

Compute Engine looks easy until the wording gets precise. This exam likes to test whether you actually know how VM administration works in GCP rather than just recognizing product names.

First, know the difference between snapshots, images, and machine images at a practical level. If the question is about backing up a persistent disk, snapshots are often right. If it’s about creating new VMs with the same boot setup, images or instance templates may fit better. If Google wants quick repeatable fleet deployment, think instance templates + managed instance groups, not manually cloned VMs.

Second, be clear on managed instance groups (MIGs). Common exam angles:

how to scale identical instances automatically
how to perform rolling updates
when to use regional MIGs for higher availability
why unmanaged groups are not the same thing

If a question wants high availability across zones with autoscaling, a regional MIG behind a load balancer is the pattern to expect.

Third, remember operational details around VM access:

OS Login can show up as the cleaner IAM-integrated answer for SSH access.
IAP TCP forwarding may be the right secure admin path when they want no public IPs.
Questions about apps calling Google APIs from a VM usually point to the instance’s attached service account, not downloaded JSON keys.

Fourth, understand disk and machine behavior that sounds obvious but causes wrong answers:

persistent disks survive VM deletion only if configured accordingly; don’t assume defaults blindly
local SSD is fast but ephemeral
resizing a persistent disk does not magically resize the filesystem unless the OS step is done
stopping a VM vs resetting it vs deleting it has billing and state implications

Google also likes startup-script questions. If the prompt asks how to install software automatically on boot across many instances, the intended answer is often metadata startup scripts in an instance template, not manual SSH or custom images unless repeatability at image level is explicitly the goal.

IAM, folders, projects, and the service account gotchas

This exam has a lot of permission questions that look simple but are really testing whether you know the Google Cloud resource hierarchy and identity model. The fastest way to stop losing points here is to think in this order: who needs access, to what scope, for how long, and is it a human or a workload?

If it’s a human needing access across multiple projects, look at folder or organization-level IAM if the prompt mentions centralized management. If it’s a workload running on GCE, GKE, or Cloud Run, think service account attached to the workload. If the question suggests downloading a key file to a VM and storing it locally, that is often the bait answer.

Specific trouble spots to review:

Primitive roles vs predefined roles: Google usually wants predefined least-privilege roles.
Service account user / service account token creator type distinctions: know that using a service account is not the same as administrating it.
Resource hierarchy inheritance: permissions granted at org/folder/project flow down.
Billing account vs project permissions: sometimes the task is blocked by billing linkage, not resource IAM.

A common pattern is a developer who needs to deploy but should not manage everything. The exam wants you to pick the narrowest deploy-relevant role, not Project Editor. Another pattern is an application that needs to access Cloud Storage. The intended answer is usually to grant the service account a storage role on the bucket or project, not to create user credentials.

Be especially careful with wording around organization policies. If the requirement is “prevent external IPs” or “restrict resource locations” across projects, IAM alone is not enough. That’s where org policies come in.

One more subtle point: Google likes asking about default service accounts. Don’t assume they should be used broadly. If the scenario emphasizes security or least privilege, a dedicated service account with only the needed roles is usually better.

Networking: the exam’s favorite “almost right” answers

Networking questions on ACE are rarely mathematically hard, but the answer choices are full of near-misses. This is where knowing GCP-specific behavior matters.

The first thing to burn into memory: subnets are regional, VPCs are global. That one fact helps eliminate a lot of nonsense answers.

Then memorize these high-frequency distinctions:

VPC peering: private connectivity between VPCs, but not a full transitive network mesh. If the question implies transitive routing through a third network, peering is not enough.
Shared VPC: use when one organization wants central network administration and multiple service projects consume the same network.
Cloud VPN: encrypted connection between on-prem and GCP; if they mention hybrid connectivity and encryption, this is a likely answer.
Cloud NAT: outbound internet access for private instances without public IPs.
Private Google Access: instances without external IPs can still reach Google APIs/services privately.

Google also likes firewall-rule traps. Remember:

firewall rules are stateful
they apply at the VPC network level but can target instances via tags or service accounts
allowing ingress on the VM OS is not the same as allowing it in the VPC firewall

Load balancer questions are another common source of misses. At ACE level, don’t get lost in every SKU; focus on the big split:

global HTTP(S) for web apps with global reach
internal load balancing for private internal traffic
if they mention TCP/UDP specifics, be ready for a non-HTTP load balancer answer

One recurring trap is confusing internal-only service exposure with just removing a public IP. Google may want an internal load balancer, firewall adjustment, or private connectivity method. “No public IP” by itself does not solve service discovery and distribution.

If you see a question about two projects needing private communication and one team owning networking centrally, compare Shared VPC and VPC peering carefully. Shared VPC is usually the better answer for centralized governance inside one organization model; peering is more about connecting separate VPCs.

Storage, databases, and the “sounds easy” questions

Cloud Storage questions are deceptively simple because everyone knows buckets and objects. The exam goes after the details: storage class choice, lifecycle rules, versioning, retention, and access method.

Know the practical difference between storage classes:

Standard for frequently accessed data
Nearline/Coldline/Archive when access frequency drops and retrieval characteristics matter

The exam may not force you to memorize every pricing nuance, but it will expect you to choose the class that matches access patterns. If the prompt says backups retained long-term and rarely read, don’t pick Standard.

Also review:

object versioning for recovering overwritten/deleted objects
lifecycle management for automated transitions/deletions
signed URLs for temporary controlled access
uniform bucket-level access vs object ACLs

A very Google-style trap is giving you a requirement like “allow external partner download access for 24 hours to specific objects.” The clean answer is often signed URLs, not broad IAM changes on the bucket.

For databases, the exam usually stays at selection and basic admin level. You should be able to quickly separate:

Cloud SQL for managed MySQL/PostgreSQL/SQL Server
Spanner for globally scalable relational consistency needs
Bigtable for large-scale low-latency NoSQL workloads
Firestore for document-oriented app patterns

Do not overcomplicate database questions. ACE is not asking you to design advanced schemas. It’s asking if you know which managed service fits the workload and which one reduces operational burden.

gcloud, console tasks, and how Google phrases operations

A distinctive part of this exam is that some questions clearly come from real admin workflows in the Console or gcloud. You are not writing full commands from scratch most of the time, but you do need to recognize which command family or admin step applies.

You should be comfortable with commands and actions related to:

creating and updating Compute Engine instances
setting project configuration in gcloud
deploying to GKE, Cloud Run, or App Engine at a basic level
creating buckets and setting IAM
listing logs or viewing monitoring data

The exam can show an operational goal and ask what command/tool is appropriate. Example patterns:

need to switch active project in CLI context
need to SSH to a VM using gcloud compute ssh
need to deploy an app version
need to inspect instance metadata or logs

What matters is not memorizing every flag. It’s knowing the native Google way to do the task. If the answer choices include a weird manual workaround and a direct gcloud/Console feature, Google usually prefers the direct platform-native path.

If the exam interface lets you mark questions for review, use that specifically for command-syntax uncertainty. Those are the easiest questions to recover later if another item jogs your memory. Don’t waste time reconstructing flags from first principles.

Final-week cram list for this specific exam

If I had seven days left for ACE, I would not reread broad cloud notes. I would run a focused checklist built around the exam’s actual traps.

Day 1-2: Compute Engine and IAM

Create mental flashcards for snapshots vs images vs instance templates.
Review managed instance groups, autoscaling, and load balancer pairing.
Drill service accounts: attached identity, least privilege, no key-file habit.
Review OS Login and IAP as secure access patterns.

Day 3: Networking

Rehearse VPC, subnet, route, firewall basics until instant recall.
Compare Shared VPC, peering, VPN, NAT, Private Google Access.
Review internal vs external load balancing use cases.

Day 4: Storage and databases

Storage classes, lifecycle rules, versioning, signed URLs.
Bucket IAM vs ACL direction of travel.
Cloud SQL vs Spanner vs Bigtable vs Firestore selection logic.

Day 5: GKE, Cloud Run, App Engine

Know exactly when Cloud Run beats GKE.
Review node pools, cluster basics, and deployment-level concepts just enough for ACE.
Revisit App Engine standard idea and when it appears as the low-ops answer.

Day 6: Operations

Cloud Logging and Cloud Monitoring basics.
Alerts, metrics, logs, startup scripts, metadata.
Backup and recovery patterns: snapshots, database backups, object versioning.

Day 7: Exam-style review

Do scenario questions only.
For every miss, label it: service selection, IAM scope, networking behavior, or operational step.
Revisit only those categories.

One blunt warning: don’t spend your last week going deep on obscure services that barely show up. ACE rewards being extremely solid on the common admin workflows far more than being vaguely familiar with the whole catalog.